fix(fix4): enforce runtime contract and orchestrator guardrails

apps/dao/sqlite.go

@@ -2,7 +2,6 @@ package dao
 
 import (
 	"errors"
-	"fmt"
 	"github.com/glebarez/sqlite"
 	"github.com/sirupsen/logrus"
 	"gorm.io/gorm"
@@ -120,7 +119,7 @@ func ensureAccountSchema() error {
 func ensureSecureBootstrapAdmin() error {
 	adminUser := strings.TrimSpace(os.Getenv("HY2XS_ADMIN_USER"))
 	if adminUser == "" {
-		adminUser = "admin"
+		adminUser = "hy2xsadmin"
 	}
 	adminPassword := strings.TrimSpace(os.Getenv("HY2XS_ADMIN_INITIAL_PASSWORD"))
 	if adminPassword == "" {
@@ -136,11 +135,14 @@ func ensureSecureBootstrapAdmin() error {
 	deviceNo := int64(envInt("HY2XS_ADMIN_DEVICE_NO", 6))
 	role := "admin"
 	deleted := int64(0)
-	conPassSecret, conErr := util.RandomString(28)
-	if conErr != nil {
-		return conErr
+	conPass := strings.TrimSpace(os.Getenv("HY2XS_ADMIN_CON_PASS"))
+	if conPass == "" {
+		generated, genErr := util.RandomString(28)
+		if genErr != nil {
+			return genErr
+		}
+		conPass = generated
 	}
-	conPass := fmt.Sprintf("%s.%s", adminUser, conPassSecret)
 	hash, hashErr := util.HashPassword(adminPassword)
 	if hashErr != nil {
 		return hashErr
@@ -169,16 +171,6 @@ func ensureSecureBootstrapAdmin() error {
 	if admin.Pass == nil {
 		return nil
 	}
-
-	updates := map[string]interface{}{
-		"username":              adminUser,
-		"pass":                  hash,
-		"con_pass":              conPass,
-		"force_password_change": forcePasswordChange,
-	}
-	if updateErr := UpdateAccount([]int64{*admin.Id}, updates); updateErr != nil {
-		return updateErr
-	}
 	return nil
 }